New WhatsApp bug via MP4 file triggers snooping concerns

Agencies
November 18, 2019

If someone has sent you an MP4 file on WhatsApp, guard against downloading it as hackers may use a critical vulnerability in the Facebook-owned app to execute snooping attack on both Android and iOS devices.

The specially crafted MP4 file triggers the remote code execution (RCE) and denial of service (DoS) cyber attack.

"The vulnerability is classified as 'Critical' severity that affected an unknown code block of the component MP4 File Handler in WhatsApp," reported gbhackers.com on Saturday.

Facebook has issued an advisory, saying "A stack-based buffer overflow could be triggered in WhatsApp by sending a specially crafted MP4 file to a WhatsApp user.

"The issue was present in parsing the elementary stream metadata of an MP4 file and could result in a DoS or RCE."

The news comes on the heels of an Israeli software Pegasus by cyber intelligence company NSO Group that exploited its video calling system to snoop on 1,400 selected users globally and in India, including human rights activists and journalists.

The issue snowballed into a political one and the Indian government denied either purchasing or planning to purchase the infamous software in question.

"We agree with the government of India's strong statement about the need to safeguard the privacy of all Indian citizens. That is why we've taken this strong action to hold cyber attackers accountable and why WhatsApp is so committed to the protection of all user messages through the product we provide," a WhatsApp spokesperson had said in a statement.

The new vulnerability is found in Android versions prior to 2.19.274; iOS versions prior to 2.19.100; Enterprise Client versions prior to 2.25.3; Business for Android versions prior to 2.19.104; Business for iOS versions prior to 2.19.100; and Windows Phone versions before and including 2.18.368.

Hackers can use the WhatsApp vulnerability to deploy the malware on the user's device to steal sensitive files and also used to surveillance purpose.

"The RCE vulnerability allows hackers to perform the attack remotely without any sort of authentication," claimed the report.

The critical WhatsApp vulnerability can be tracked as CVE-2019-11931.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.
News Network
May 30,2020

May 30: Patients undergoing surgery after contracting the novel coronavirus are at an increased risk of postoperative death, according to a new study published in The Lancet journal which may lead to better treatment guidelines for COVID-19.

In the study, the scientists, including those from the University of Birmingham in the UK, examined data from 1,128 patients from 235 hospitals from a total of 24 countries.

Among COVID-19 patients who underwent surgery, they said the death rates approach those of the sickest patients admitted to intensive care after contracting the virus.

The scientists noted that SARS-CoV-2 infected patients who undergo surgery, experience substantially worse postoperative outcomes than would be expected for similar patients who do not have the infection.

According to the study, the 30-day mortality among these patients was nearly 24 per cent.

The researchers noted that mortality was disproportionately high across all subgroups, including those who underwent elective surgery (18.9 per cent), and emergency surgery (25.6 per cent).

Those who underwent minor surgery, such as appendicectomy or hernia repair (16.3 per cent), and major surgery such as hip surgery or for colon cancer also had higher mortality rates (26.9 per cent), the study said.

According to the study, the mortality rates were higher in men versus women, and in patients aged 70 years or over versus those aged under 70 years.

The scientists said in addition to age and sex, risk factors for postoperative death also included having severe pre-existing medical problems, undergoing cancer surgery, undergoing major procedures, and undergoing emergency surgery.

"We would normally expect mortality for patients having minor or elective surgery to be under 1 per cent, but our study suggests that in SARS-CoV-2 patients these mortality rates are much higher in both minor surgery (16.3%) and elective surgery (18.9%)," said study co-author Aneel Bhangu from the University of Birmingham.

Bhangu said these mortality rates are greater than those reported for even the highest-risk patients before the pandemic.

Citing an example from the 2019 UK National Emergency Laparotomy Audit report, he said the 30-day mortality was 16.9 per cent in the highest-risk patients.

Based on an earlier study across 58 countries, Bhangu said the 30-day mortality was 14.9 per cent in patients undergoing high-risk emergency surgery.

"We recommend that thresholds for surgery during the SARS-CoV-2 pandemic should be raised compared to normal practice," he said.

"For example, men aged 70 years and over undergoing emergency surgery are at particularly high risk of mortality, so these patients may benefit from their procedures being postponed," Bhangu added.

The study also noted that patients undergoing surgery are a vulnerable group at risk of SARS-CoV-2 exposure in hospital.

It noted that the patients may also be particularly susceptible to subsequent pulmonary complications, due to inflammatory and immunosuppressive responses to surgery and mechanical ventilation.

The scientists found that overall in the 30 days following surgery 51 per cent of patients developed a pneumonia, acute respiratory distress syndrome, or required unexpected ventilation.

Nearly 82 per cent of the patients who died had experienced pulmonary complications, the researchers said.

"Worldwide an estimated 28.4 million elective operations were cancelled due to disruption caused by COVID-19," said co-author Dmitri Nepogodiev from the University of Birmingham.

"Our data suggests that it was the right decision to postpone operations at a time when patients were at risk of being infected with SARS-CoV-2 in hospital," Nepogodiev said.

According to the researchers, there's now an urgent need for investment by governments and health providers in to measures which ensure that as surgery restarts patient safety is prioritised.

They said this includes the provision of adequate personal protective equipment (PPE), establishment of pathways for rapid preoperative SARS-CoV-2 testing, and consideration of the role of dedicated 'cold' surgical centres.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.
Agencies
May 15,2020

Kolkata, May 15: Veteran Bengali author Debesh Roy, who was conferred the Sahitya Akademi award for his novel 'Teesta Parer Brittanto', died at a private hospital in Kolkata on Thursday, his family members said.

Roy was 84 and he is survived by his son. His wife had died earlier.

He was admitted to the hospital near his residence at Baguihati, in the eastern fringes of the city, on Wednesday after having symptoms like sodium potasium imbalance, sugar problem and breathing problem, his family members said.

He suffered a massive cardiac arrest and died at 10.50 PM.

A regular contributor to a number of Bengali dailies, he was a staunch critic of the attacks on liberals by in the country in recent times and attended protest meetings despite his failing health.

He was born in Pabna in present-day Bangladesh on December 17, 1936. He had five decades of career as a writer.

Besides Teesta Parer Britanta', he will be remembered for books like Borisaler Jogen Mondal , Manush Khun Kore Keno and Samay Asamayer Brittanto . His first book was Jajati.

His last rites will be performed tomorrow.

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.
Agencies
February 23,2020

Google has indexed invite links to private WhatsApp group chats, meaning anyone can join various private chat groups (including several porn-sharing groups) with a simple search.

According to a report in Motherboard, invitations to WhatsApp group chats were being indexed by Google.

The team found private groups using specific Google searches and even joined a group intended for NGOs accredited by the UN and had access to all the participants and their phone numbers.

Journalist Jordan Wildon said on Twitter that he discovered that WhatsApp's "Invite to Group Link" feature lets Google index groups, making them available across the internet since the links are being shared outside of WhatsApp's secure private messaging service.

"Your WhatsApp groups may not be as secure as you think they are," Wildon tweeted on Friday, adding that using particular Google searches, people can discover links to the chats.

According to app reverse-engineer Jane Wong, Google has around 470,000 results for a simple search of "chat.whatsapp.com", part of the URL that makes up invites to WhatsApp groups.

WhatsApp spokesperson Alison Bonny said: "Like all content that is shared in searchable public channels, invite links that are posted publicly on the internet can be found by other WhatsApp users."

"The links that users wish to share privately with people they know and trust should not be posted on a publicly accessible website," Bonny told The Verge.

Danny Sullivan, Google's public search liaison, tweeted: "Search engines like Google & others list pages from the open web. That's what's happening here. It's no different than any case where a site allows URLs to be publicly listed. We do offer tools allowing sites to block content being listed in our results."

Comments

Add new comment

  • Coastaldigest.com reserves the right to delete or block any comments.
  • Coastaldigset.com is not responsible for its readers’ comments.
  • Comments that are abusive, incendiary or irrelevant are strictly prohibited.
  • Please use a genuine email ID and provide your name to avoid reject.